@lssm-tech/module.personal-experience
The PersonalOS composition seam between RoleMorph and Personalization. It first resolves the authority-aware surface, then layers canonical presentation-only preferences. Explicit choices win over adaptive hints, and the result includes an explanation plus a complete reset patch. Missing delegated authority fails closed before any surface is returned.
composePersonalPresentation() is the canonical host seam. It selects the personal RoleMorph surface first, suppresses invalid diagnostics, and permits delegated projection only for an exact active view_shared_projection grant. The canonical registry and surface specifications are deeply frozen, and the delegated role profile must match the exact active household member role and time window. It then layers default, adaptive, and explicit preferences in that order. The wire result contains six minimized areas, component/action identifiers, authority boundaries, source attribution, generic explanations, a schema-verified domain-separated resolution hash, and a complete reset patch. It never contains component data, decision reasons, evidence, credentials, or raw behavior.
PersonalExperienceIdentitySession is the shared client-session boundary for Personalization buffers. It derives an exact scope from the server-issued opaque tenant/consent binding and outer subject/actor refs, preserves buffers through transient loading, offline, denial, and retry states, and requires an explicit drain or discard on sign-out, account switch, tenant switch, or consent change. Collection cannot attach without granted consent; failed retirement discards every old buffer and leaves the session signed out.
PersonalCalmDesignPack adds shared responsive/native layout recipes for a single-focus Today view, progressive disclosure, resumable workflows, and an always-reachable privacy state. It extends the existing Wellness Soft pack.
The package also owns the cross-surface golden-journey, privacy-center, and offline-command policies. Consent, sharing, health connections, delegation, authority, export, and deletion always revalidate online. Offline eligibility comes from the package's exact trusted action registry; caller-supplied risk or undo metadata cannot widen it. Eligible commands carry a canonical undo and must revalidate server authority and revision before replay.
./offline-admission is the shared admission and integrity check for every host queue: admitPersonalOfflineEnvelopeV1 parses the envelope, binds the authenticated subject, and admits only registry actions with the exact risk and canonical undo; verifyQueuedPersonalOfflineCommandV1 re-checks a stored envelope against current policy and the metadata persisted beside it; and
admitPersonalOfflineActionV1 applies the same rule to a bare action request. Hosts keep only their storage (SQLite, IndexedDB, Tauri) adapters.
./offline-replay owns the canonical replay state machine,
replayPersonalOfflineCommandsV1, behind outbox and dispatch ports: online only, at most 25 due commands per pass, a block after 5 attempts, a policy re-check (registry, risk, undo) before every dispatch, completion only on delivery, terminal blocks for authority/revision/integrity decisions, and an exponential backoff (2^attempt seconds, capped at 15 minutes) that defers the first transient failure and ends the pass. The HTTP, thrown-error, and domain result classifiers normalize host transports into replay outcomes.
./presentation-access is the one client-side presentation access policy used by the web, desktop, and mobile hosts. It fails closed: a missing presentation, or one generated more than 5 minutes ago (PERSONAL_PRESENTATION_MAX_AGE_MS) or more than 1 minute in the future, is unavailable and blocks every governed action; hosts may render only a safe, action-free display. Area access needs exactly one allowed area entry whose component references each resolve to one allowed component of that area; the <area>.manage boundary needs exactly one area-bound action. Only allowed, or requires_approval with an explicit per-submission approval, may submit. The policy is presentation-only; the server re-validates authority for every command.
./journey-actions owns the canonical journey action catalog (PERSONAL_JOURNEY_ACTION_CATALOG_V1): the snake_case action ids used by the runtime command families, each action's command family, governing presentation area, and the surfaces that offer it, in display order.
personalJourneyActionsForSurfaceV1, isPersonalJourneyActionOnSurfaceV1, and
isPersonalJourneyActionInFamilyV1 let hosts route actions to their own form adapters without re-declaring the catalog. Hosts with other ids (mobile kebab-case) keep an explicit alias table onto these ids.
